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"The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 

THE REPLY FILED 31 December 2003 FAILS TO PLACE THIS APPLICATION IN CONDITION FOR ALLOWANCE. 
Therefore, further action by the applicant is required to avoid abandonment of this application, A proper reply to a 
final rejection under 37 CFR 1.113 may only be either: (1) a timely filed amendment which places the application in 
condition for allowance; (2) a timely filed Notice of Appeal (with appeal fee); or (3) a timely filed Request for Continued 
Examination (RCE) in compliance with 37 CFR 1.114. 



a) K The period for reply expires 3_months from the mailing date of the final rejection. 

b) n The period for reply expires on: (1 ) the mailing date of this Advisory Action, or (2) the date set forth in the final rejection, whichever is later. In no 

event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of the final rejection. 

ONLY CHECK THIS BOX WHEN THE FIRST REPLY WAS FILED WITHIN TWO MONTHS OF THE FINAL REJECTION. See MPEP 

706.07(f). 

Extensions of time may be obtained under 37 CFR 1 .1 36(a). The date on which the petition under 37 CFR 1 .1 36(a) and the appropriate extension fee 
have been filed is the date for purposes of determining the period of extension and the corresponding amount of the fee. The appropriate extension fee under 
37 CFR 1 .17(a) is calculated from: (1 ) the expiration date of the shortened statutory period for reply originally set in the final Office action; or (2) as set forth in 
(b) above, if checked. Any reply received by the Office later than three months after the mailing date of the final rejection, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

1 □ A Notice of Appeal was filed on . Appellant's Brief must be filed within the period set forth in 

37 CFR 1.192(a), or any extension thereof (37 CFR 1.191(d)), to avoid dismissal of the appeal. 

20 The proposed amendment(s) will not be entered because: 

(a) □ they raise new issues that would require further consideration and/or search (see NOTE below); 

(b) □ they raise the issue of new matter (see Note below); 

(c) □ they are not deemed to place the application in better form for appeal by materially reducing or simplifying the 

issues for appeal; and/or 

(d) □ they present additional claims without canceling a corresponding number of finally rejected claims. 

NOTE: . 

3. n Applicant's reply has overcome the following rejection(s): . 

4. n Newly proposed or amended claim(s) would be allowable if submitted in a separate, timely filed amendment 

canceling the non-allowable claim(s). 

5.13 The a)n affidavit, b)n exhibit, or c)l3 request for reconsideration has been considered but does NOT place the 
application in condition for allowance because: See Continuation Sheet . 

6. n The affidavit or exhibit will NOT be considered because it is not directed SOLELY to issues which were newly 

raised by the Examiner in the final rejection. 

7. n For purposes of Appeal, the proposed amendment(s) a)n will not be entered or b)n will be entered and an 

explanation of how the new or amended claims would be rejected is provided below or appended. 

The status of the claim(s) is (or will be) as follows: 

Claim(s) allowed: . 

Claim(s) objected to: . 

Claim(s) rejected: . 

Claim(s) withdrawn from consideration: . 

8. n The drawing correction filed on is 3)0 approved or b)^ disapproved by the Examiner. 

90 Note the attached Information Disclosure Statement(s)( PTO-1449) Paper No(s). . 
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Continuation of 5. does NOT place the application in condition for allowance because: The applicant argues that Huff discloses only an 
IDS that is aware of only actual intrusions. The applicant argues that Huff fails to disclose a VDS. The applicant argues that Huff that 
the agents are not aware of potential attacks but of only actual attacks. The applicant argues that Huff fails to distinguish the 
vulnerabilities of one host from other hosts while exannining traffic. The examiner respectfully disagrees. The examiner asserts that the 
IDS is aware of actual attacks and suspected threats and also it is not claimed that the IDS is aware of only potential attacks. As cited 
by the examiner in the previous action, Huff does discloses an agent that is capable of gathering information about the network to 
determine vulnerabilities of the hosts on the network. Huff is able to distinguish threats on each node... 



